From b4c5e79c432a92e19be010ea7e41f20bef967b3c Mon Sep 17 00:00:00 2001 From: Heiko Weber Date: Wed, 15 Jun 2022 16:37:04 +0200 Subject: [PATCH 1/3] Fix: php_binary_init: WIN32 binary_location use after free --- main/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/main/main.c b/main/main.c index 7bd5400760f05..71682c7960da5 100644 --- a/main/main.c +++ b/main/main.c @@ -355,7 +355,7 @@ static void php_binary_init(void) binary_location = (char *)malloc(MAXPATHLEN); if (binary_location && GetModuleFileName(0, binary_location, MAXPATHLEN) == 0) { free(binary_location); - PG(php_binary) = NULL; + binary_location = NULL; } #else if (sapi_module.executable_location) { @@ -386,7 +386,7 @@ static void php_binary_init(void) free(binary_location); binary_location = NULL; } - } else if (!VCWD_REALPATH(sapi_module.executable_location, binary_location) || VCWD_ACCESS(binary_location, X_OK)) { + } else if (binary_location && !VCWD_REALPATH(sapi_module.executable_location, binary_location) || VCWD_ACCESS(binary_location, X_OK)) { free(binary_location); binary_location = NULL; } From b1ed6d5819839207f76fe7570be3ee7578c707a6 Mon Sep 17 00:00:00 2001 From: Heiko Weber Date: Wed, 15 Jun 2022 16:43:10 +0200 Subject: [PATCH 2/3] use pemalloc --- main/main.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/main/main.c b/main/main.c index 71682c7960da5..ca5da2f905466 100644 --- a/main/main.c +++ b/main/main.c @@ -352,15 +352,15 @@ static void php_binary_init(void) { char *binary_location = NULL; #ifdef PHP_WIN32 - binary_location = (char *)malloc(MAXPATHLEN); - if (binary_location && GetModuleFileName(0, binary_location, MAXPATHLEN) == 0) { - free(binary_location); + binary_location = (char *)pemalloc(MAXPATHLEN, 1); + if (GetModuleFileName(0, binary_location, MAXPATHLEN) == 0) { + pefree(binary_location, 1); binary_location = NULL; } #else if (sapi_module.executable_location) { - binary_location = (char *)malloc(MAXPATHLEN); - if (binary_location && !strchr(sapi_module.executable_location, '/')) { + binary_location = (char *)pemalloc(MAXPATHLEN); + if (!strchr(sapi_module.executable_location, '/')) { char *envpath, *path; int found = 0; @@ -383,11 +383,11 @@ static void php_binary_init(void) efree(path); } if (!found) { - free(binary_location); + pefree(binary_location, 1); binary_location = NULL; } - } else if (binary_location && !VCWD_REALPATH(sapi_module.executable_location, binary_location) || VCWD_ACCESS(binary_location, X_OK)) { - free(binary_location); + } else if (!VCWD_REALPATH(sapi_module.executable_location, binary_location) || VCWD_ACCESS(binary_location, X_OK)) { + pefree(binary_location, 1); binary_location = NULL; } } From 17521ad6193c44efb623152a05fdfdd835574b57 Mon Sep 17 00:00:00 2001 From: Heiko Weber Date: Wed, 15 Jun 2022 16:51:06 +0200 Subject: [PATCH 3/3] overlooked the 2nd. param --- main/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main/main.c b/main/main.c index ca5da2f905466..a40a4c8c37cdc 100644 --- a/main/main.c +++ b/main/main.c @@ -359,7 +359,7 @@ static void php_binary_init(void) } #else if (sapi_module.executable_location) { - binary_location = (char *)pemalloc(MAXPATHLEN); + binary_location = (char *)pemalloc(MAXPATHLEN, 1); if (!strchr(sapi_module.executable_location, '/')) { char *envpath, *path; int found = 0;